---
title: "VMware vCenter plugin SSRF (CVE-2021-21973)"
canonical: https://trickest.com/library/cve-2021-21973-vcenter-plugin-ssrf
description: "Flag VMware vCenter hosts for CVE-2021-21973 by reading version and build from GET /sdk. Floor is 7.0 U1c build 17327517. No SSRF."
---

# VMware vCenter plugin SSRF (CVE-2021-21973)

## Overview

This workflow finds VMware vCenter Server and sorts each host by whether its version and build fall below the CVE-2021-21973 floor in the graph. CVE-2021-21973 is server-side request forgery in a vCenter plugin caused by improper URL validation. This check never sends a crafted plugin request. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/sdk`, fingerprints vCenter from markers in that response, parses the `VMware vCenter Server` version and `build-` number, and compares the tuple to 7.0 U1c build 17327517. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no SOAP body, no plugin hit, and no SSRF confirm.

Run it on a schedule when management planes change. A rebuilt VCSA that landed on an older 7.0 build is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/sdk` on each host and fingerprint vCenter from response markers such as `VMware vCenter Server`, `vim.ServiceInstance`, and `build-`.
3. Parse the version and build string and compare the tuple to the CVE-2021-21973 floor in the graph (7.0 U1c build 17327517).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether vCenter was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/sdk` only. No SOAP RetrieveServiceContent body and no plugin SSRF probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one vCenter host below the graph floor, one at or above 7.0 U1c build 17327517, and one host that is not the product.

```jsonl
{"url": "https://vc.example.com", "is_product": true, "product_version": "7.0.1.17327500", "vulnerable": true, "detail": "below 7.0 U1c build 17327517"}
{"url": "https://vc.example.org", "is_product": true, "product_version": "7.0.1.17327517", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as VMware vCenter Server"}
```

```json
{"cve": "CVE-2021-21973", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which vCenter versions does this flag?

Hosts whose parsed version and build tuple fall below 7.0 U1c build 17327517, the single floor coded in the graph. The compare uses the string the `/sdk` response itself served.

### Does an affected row mean the plugin SSRF worked?

No. The check only GETs `/sdk` and reads version and build. It does not post a SOAP body, does not hit a plugin URL, and does not confirm SSRF.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of `/sdk`. It does not log in or trigger a server-side fetch.

### Does the check need credentials?

No. It fingerprints the public `/sdk` surface the way an external scanner would.

### What is CVE-2021-21973?

Server-side request forgery in a VMware vCenter Server plugin from improper URL validation. This workflow maps hosts to that CVE by version and build exposure only.

## Related workflows

- [vCenter Plugin RCE (CVE-2021-21972)](/library/cve-2021-21972-vcenter-vsphere-client-plugin-rce). Reach for it when you need the earlier vSphere Client plugin RCE fingerprint.
- [vCenter Info Disclosure (CVE-2022-22948)](/library/vmware-vcenter-server-info-disclosure-cve-2022-22948). Reach for it when you need the later vCenter information disclosure check.

---
_Markdown source of https://trickest.com/library/cve-2021-21973-vcenter-plugin-ssrf._